Fortinet NSE7_EFW-6.0 Online Practice Questions and Exam Preparation

Fortinet NSE7_EFW-6.0 Online Questions & Answers

• Question 1:

  Which of the following statements are correct regarding application layer test commands? (Choose two.)

  A. Some of them display statistics and configuration information about a feature or process.
  B. They are used to filter real-time debugs.
  C. They display real-time application debugs.
  D. Some of them can be used to restart an application.
  A. Some of them display statistics and configuration information about a feature or process.
  D. Some of them can be used to restart an application.

• Question 2:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  

  Which of the following statements about this debug output are correct? (Choose two.)

  A. It shows a phase 1 negotiation.
  B. The initiator has provided remote as its IPsec peer ID.
  C. The negotiation is using AES128 encryption with CBC hash.
  D. The remote gateway IP address is 10.0.0.1.
  A. It shows a phase 1 negotiation.
  B. The initiator has provided remote as its IPsec peer ID.

• Question 3:

  What is the purpose of an internal segmentation firewall (ISFW)?

  A. It is the first line of defense at the network perimeter.
  B. It inspects incoming traffic to protect services in the corporate DMZ.
  C. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.
  D. It splits the network into multiple security segments to minimize the impact of breaches.
  D. It splits the network into multiple security segments to minimize the impact of breaches.

• Question 4:

  View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.

  

  Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?

  A. auto-discovery-receiver
  B. auto-discovery-forwarder
  C. auto-discovery-sender
  D. auto-discovery-shortcut
  A. auto-discovery-receiver

• Question 5:

  An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

  A. diagnose sniffer packet any 'esp'
  B. diagnose sniffer packet any 'tcp port 500 or tcp port 4500'
  C. diagnose sniffer packet any 'udp port 4500'
  D. diagnose sniffer packet any 'udp port 500'
  A. diagnose sniffer packet any 'esp'

• Question 6:

  View these partial outputs from two routing debug commands:

  

  Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?

  A. Both port1 and port2
  B. port3
  C. port2
  D. port1
  A. Both port1 and port2

• Question 7:

  Which of the following statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)

  A. When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.
  B. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
  C. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.
  D. When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.
  B. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.
  C. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.

• Question 8:

  View the following FortiGate configuration.

  

  All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network.

  

  If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

  A. The session would be deleted, so the client would need to start a new session.
  B. The session would remain in the session table, and its traffic would still egress from port1.
  C. The session would remain in the session table, and its traffic would start to egress from port2.
  D. The session would remain in the session table, but its traffic would now egress from both port1 and port2.
  B. The session would remain in the session table, and its traffic would still egress from port1.

• Question 9:

  What does the dirty flag mean in a FortiGate session?

  A. The session must be removed from the former primary unit after an HA failover.
  B. Traffic has been identified as from an application that is not allowed.
  C. The next packet must be re-evaluated against the firewall policies.
  D. Traffic has been blocked by the antivirus inspection.
  C. The next packet must be re-evaluated against the firewall policies.

• Question 10:

  What configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

  A. mem-failopen
  B. ips-failopen
  C. utm-failopen
  D. av-failopen
  B. ips-failopen
  D. av-failopen